CVE Vulnerability Catalog

Prior to version 7.1.2-32 of ImageMagick, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. This issue is fixed in version 7.1.2-32.

Prior to version 7.1.2-32 of ImageMagick, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32.

Prior to versions 7.1.2-32 and 6.9.13-57 of ImageMagick, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.

Prior to versions 7.1.2-32 and 6.9.13-57 of ImageMagick, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in versions 7.1.2-32 and 6.9.13-57.

In ImageMagick prior to 7.1.2-32, the delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable. This allows a local privileged workflow to overwrite a file with random data. The issue is fixed in version 7.1.2-32.

In ImageMagick prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop. This exhausts processing resources. The issue is fixed in versions 7.1.2-32 and 6.9.13-57.

In ImageMagick prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer. This causes the process to crash. The issue is fixed in version 7.1.2-32.

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, leading to out-of-bounds reads and disclosure of adjacent heap memory, including heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR.

In praisonai-platform prior to 0.1.9, dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading specially crafted file metadata.

A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. An authenticated administrator can submit a value containing shell metacharacters, leading to arbitrary OS command execution with root privileges.

A flaw was found in source-to-image where unpacking archive files fails to properly sanitize symbolic links pointing to absolute file paths. An attacker supplying a malicious builder image can embed links pointing outside the extraction directory. This bypasses sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.

A flaw was found in m17n-lib where an attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This causes the application to crash unexpectedly, resulting in a Denial of Service (DoS).

A flaw was found in m17n-lib where a user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. This can cause applications relying on the library to crash, leading to a Denial of Service (DoS), or potentially allow arbitrary code execution.

A flaw has been found in XnView Classic 2.52.5 in an unknown function of the FLI File Parser component. Manipulation of the starting_line argument causes a heap-based buffer overflow. Remote exploitation is possible. Upgrading to version 2.52.6 is recommended.

In Backstage prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in a deprecated Kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes workload data beyond their intended scope by supplying crafted entity data to the deprecated services endpoint. The exposure is limited to read-only access to Kubernetes object metadata across configured clusters. This issue is fixed in version 0.21.8.

In Backstage prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.

The @backstage/plugin-kubernetes-backend package prior to 0.21.9 allows an authenticated user with standard Kubernetes resource read permission to retrieve sensitive values that the plugin is designed to mask. This can expose credentials and other confidential material held in connected clusters, limited to resources the Backstage service account is permitted to read.

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process.

The @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package prior to 0.3.25 is affected by improper input validation in the Confluence to Markdown scaffolder module. This could allow an attacker to influence file write operations during template execution if a Backstage user runs a template that processes attacker-influenced Confluence content.